The Voivodeship Administrative Court in Warsaw upheld decision of the President of Polish SA

The issue is the transfer of data from the POL-on database to the Ministry of Health for analysis of the degree of inoculation against COVID-19 at universities. There was no legal basis for this.

Following a complaint from a citizen who is a researcher at a Polish university, the President of the Personal Data Protection Office investigated the matter and issued warnings to four institutions: The Minister of Health and the subordinate the e-Health Centre, as well as the Minister of Education and Science and the National Information Processing Institute - State Research Institute, which he supervises.

The POL-on database contains data on scientists. In order for the e-Health Centre to be able to create the statistical study “Summary of Vaccination Actions at Polish Universities,” the Minister of Education and Science/the National Information Processing Institute provided it with national identification number (PESEL) from POL-on, along with the assigned statuses of individuals (student, doctoral student, university employee) and data identifying the university. The e-Health Centre compared them with data from the P1 system (Electronic Platform for the Collection, Analysis and Sharing of Digital Resources on Medical Events). The analysis resulted in a statistical summary in the following areas: name of the university, university ID, group (student, doctoral student, employee), vaccination status in the group (none, one dose, full dose), number of people in the group, information on which ID the comparison by the e-Health Centre was conducted to obtain the statistical result.

The Centre returned the statistics described above to the Ministry of Education and Science. The National Information Processing Institute, in turn, prepared a publication on its website.

There was no legal basis for such an operation. The fact that a state possesses some data is not enough for its institutions to process it freely. Both the personal data of POL scientists and their data from the P1 system were used for different purposes than they were collected. The purposes of the processing of personal data resulting from the Cooperation Agreement of December 21, 2021, between the Ministry of Education and Science and the Ministry of Health, do not fall within the catalogues of purposes for the processing of personal data in both the POL-on system and the SIM (Medical Information System, one part of the P1 system), as defined in the relevant laws.

The e-Health Centre has filed a complaint with the Voivodeship Administrative Court in Warsaw against the decision of the President of Personal Data Protection Office. The Court upheld the decision of the President of Personal Data Protection Office in a judgment dated January 14, 2025 (ref. II SA/Wa 536/24). The Court's reasoning is not yet known.

DS.523.704.2022